Question

A security team must be alerted within minutes whenever the AWS account root user signs in to the Management Console. CloudTrail is already delivering management events to a CloudWatch Logs log group in the same account. The team wants a solution that uses only native AWS logging and monitoring services, with no custom code to maintain. Which approach meets these requirements?

Accepted Answer

Create a CloudWatch Logs metric filter on the log group that matches events where userIdentity.type is Root and eventName is ConsoleLogin, then create a CloudWatch alarm on that metric that publishes to an SNS topic.

Answer

Enable Amazon Athena on the CloudTrail S3 bucket and schedule a query every five minutes to detect root console logins, sending results to SNS.

Answer

Configure AWS Config with a custom rule that evaluates CloudTrail events and triggers an SNS notification when the root user logs in.

Answer

Create a VPC Flow Logs subscription filter that forwards root login records to a Lambda function which invokes SNS.